Found it. For the record:
I was using the epicsOldString typedef (deprecated, I know) as a convenient way to have a fixed size string type.
Inside a function with an argument defined as epicsOldString *text , I did the "make sure it is null terminated" write as
*text[MAX_STRING_SIZE-1] = '\0';
instead of
(*text)[MAX_STRING_SIZE-1] = '\0';
Just rarely, depending on heap memory layout, the '\0' hit specific places in areas of memory with record instances, the structures were corrupted in a way that segfaulted the IOC.
Note to myself: Array typedefs are EVIL.
Thanks for all the hints!
~Ralph
